safe-decode-uri-component - npm Package Compare versions

Comparing version 1.1.3-native to 1.1.3

package.json

 {
   "name": "safe-decode-uri-component",
-  "version": "1.1.3-native",
+  "version": "1.1.3",
   "description": "Safely decode URI components, leaving invalid sequences as they are",
@@ -8,6 +8,3 @@ "main": "src/index.js",
     "test": "node tests/index",
-    "benchmark": "node benchmark",
-    "install": "prebuild-install || node-gyp rebuild",
-    "rebuild": "prebuild --compile",
-    "prebuild": "prebuild --all --strip --verbose"
+    "benchmark": "node benchmark"
   },
@@ -29,16 +26,6 @@ "repository": {
   "homepage": "https://github.com/jridgewell/safe-decode-uri-component#readme",
-  "engines": {
-    "node": ">=4.0.0"
-  },
-  "gypfile": true,
   "devDependencies": {
     "benchmark": "^2.1.4",
-    "microtime": "^2.1.6",
-    "prebuild": "^6.2.2"
-  },
-  "dependencies": {
-    "bindings": "^1.3.0",
-    "node-gyp": "^3.6.2",
-    "prebuild-install": "^2.3.0"
+    "microtime": "^2.1.6"
   }
 }

README.md

 # safe-decode-uri-component
 
-[![Build Status](https://travis-ci.org/jridgewell/safe-decode-uri-component.svg?branch=native)](https://travis-ci.org/jridgewell/safe-decode-uri-component)
+[![Build Status](https://travis-ci.org/jridgewell/safe-decode-uri-component.svg?branch=master)](https://travis-ci.org/jridgewell/safe-decode-uri-component)
 
@@ -5,0 +5,0 @@ Decodes strings encoded by `encodeURI` and `encodeURIComponent`, without

src/index.js

@@ -1,1 +0,117 @@
-module.exports = require('bindings')('safe_decode_uri_component.node');
+"use strict";
+
+module.exports = function decodeURIComponent(string) {
+  let k = string.indexOf('%');
+  if (k === -1) return string;
+
+  const length = string.length;
+  let decoded = '';
+  let last = 0;
+  let codepoint = 0;
+  let startOfOctets = k;
+  state = UTF8_ACCEPT;
+
+  while (k > -1 && k < length - 2) {
+    const high = hexCodeToInt(string[k + 1], 4);
+    const low = hexCodeToInt(string[k + 2], 0);
+    codepoint = decode(codepoint, high | low);
+
+    switch (state) {
+      case UTF8_ACCEPT:
+        decoded += string.substring(last, startOfOctets);
+
+        decoded += (codepoint <= 0xFFFF) ?
+          String.fromCharCode(codepoint) :
+          String.fromCharCode(
+            (0xD7C0 + (codepoint >> 10)),
+            (0xDC00 + (codepoint & 0x3FF))
+          );
+
+        codepoint = 0;
+        last = k + 3;
+        k = startOfOctets = string.indexOf('%', last);
+        break;
+      default:
+        k += 3;
+        if (k < length && string[k] === '%') break;
+
+        // Intentional fall-through
+      case UTF8_REJECT:
+        state = UTF8_ACCEPT;
+        codepoint = 0;
+        k = startOfOctets = string.indexOf('%', startOfOctets + 1);
+        break;
+    }
+  }
+
+  return decoded + string.substring(last);
+};
+
+const HEX = Object.assign(Object.create(null), {
+  '0':  0, '1':  1,
+  '2':  2, '3':  3,
+  '4':  4, '5':  5,
+  '6':  6, '7':  7,
+  '8':  8, '9':  9,
+  'a': 10, 'A': 10,
+  'b': 11, 'B': 11,
+  'c': 12, 'C': 12,
+  'd': 13, 'D': 13,
+  'e': 14, 'E': 14,
+  'f': 15, 'F': 15,
+});
+function hexCodeToInt(c, shift) {
+  const i = HEX[c];
+  return i === undefined ? 255 : i << shift;
+}
+
+
+/**
+ * The below algorithm is based on Bjoern Hoehrmann's DFA Unicode Decoder.
+ * Copyright (c) 2008-2009 Bjoern Hoehrmann <[e-mail]>
+ * See http://bjoern.hoehrmann.de/utf-8/decoder/dfa/ for details.
+ */
+const UTF8_ACCEPT = 12;
+const UTF8_REJECT = 0;
+const UTF8_DATA = [
+  // The first part of the table maps bytes to character to a transition.
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   0, 0, 0, 0,  0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0, 0,
+   1, 1, 1, 1,  1, 1, 1, 1,   1, 1, 1, 1, 1, 1, 1, 1,
+   2, 2, 2, 2,  2, 2, 2, 2,   2, 2, 2, 2, 2, 2, 2, 2,
+   3, 3, 3, 3,  3, 3, 3, 3,   3, 3, 3, 3, 3, 3, 3, 3,
+   3, 3, 3, 3,  3, 3, 3, 3,   3, 3, 3, 3, 3, 3, 3, 3,
+   4, 4, 5, 5,  5, 5, 5, 5,   5, 5, 5, 5, 5, 5, 5, 5,
+   5, 5, 5, 5,  5, 5, 5, 5,   5, 5, 5, 5, 5, 5, 5, 5,
+   6, 7, 7, 7,  7, 7, 7, 7,   7, 7, 7, 7, 7, 8, 7, 7,
+  10, 9, 9, 9, 11, 4, 4, 4,   4, 4, 4, 4, 4, 4, 4, 4,
+
+  // The second part of the table maps a state to a new state when adding a
+  // transition.
+   0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+  12,  0,  0,  0,  0, 24, 36, 48, 60, 72, 84, 96,
+   0, 12, 12, 12,  0,  0,  0,  0,  0,  0,  0,  0,
+   0,  0,  0, 24,  0,  0,  0,  0,  0,  0,  0,  0,
+   0, 24, 24, 24,  0,  0,  0,  0,  0,  0,  0,  0,
+   0, 24, 24,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+   0, 48, 48, 48,  0,  0,  0,  0,  0,  0,  0,  0,
+   0,  0, 48, 48,  0,  0,  0,  0,  0,  0,  0,  0,
+   0, 48,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+
+  // The third part maps the current transition to a mask that needs to apply
+  // to the byte.
+  0x7F, 0x3F, 0x3F, 0x3F, 0x00, 0x1F, 0x0F, 0x0F, 0x0F, 0x07, 0x07, 0x07,
+];
+
+let state = UTF8_ACCEPT;
+function decode(codepoint, byte) {
+  const type = UTF8_DATA[byte];
+  state = UTF8_DATA[256 + state + type];
+  return (codepoint << 6) | (byte & UTF8_DATA[364 + type]);
+}

Fixed alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Dependency count

0

decreased by-100%

Dev dependency count

2

decreased by-33.33%

Lines of code

358

increased by39.84%

Number of low quality alerts

0

decreased by-100%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

59270

decreased by-8.89%

Number of package files

13

decreased by-13.33%

Dependency changes

• - Removedbindings@^1.3.0

• - Removednode-gyp@^3.6.2

• - Removedprebuild-install@^2.3.0

• - Removedabbrev@1.1.1(transitive)

• - Removedajv@6.12.6(transitive)

• - Removedansi-regex@2.1.1(transitive)

• - Removedaproba@1.2.0(transitive)

• - Removedare-we-there-yet@1.1.7(transitive)

• - Removedasn1@0.2.6(transitive)

• - Removedassert-plus@1.0.0(transitive)

• - Removedasynckit@0.4.0(transitive)

• - Removedaws-sign2@0.7.0(transitive)

• - Removedaws4@1.13.2(transitive)

• - Removedbalanced-match@1.0.2(transitive)

• - Removedbcrypt-pbkdf@1.0.2(transitive)

• - Removedbindings@1.5.0(transitive)

• - Removedbl@1.2.3(transitive)

• - Removedblock-stream@0.0.9(transitive)

• - Removedbrace-expansion@1.1.11(transitive)

• - Removedbuffer-alloc@1.2.0(transitive)

• - Removedbuffer-alloc-unsafe@1.1.0(transitive)

• - Removedbuffer-fill@1.0.0(transitive)

• - Removedcaseless@0.12.0(transitive)

• - Removedchownr@1.1.4(transitive)

• - Removedcode-point-at@1.1.0(transitive)

• - Removedcombined-stream@1.0.8(transitive)

• - Removedconcat-map@0.0.1(transitive)

• - Removedconsole-control-strings@1.1.0(transitive)

• - Removedcore-util-is@1.0.21.0.3(transitive)

• - Removeddashdash@1.14.1(transitive)

• - Removeddecompress-response@3.3.0(transitive)

• - Removeddeep-extend@0.6.0(transitive)

• - Removeddelayed-stream@1.0.0(transitive)

• - Removeddelegates@1.0.0(transitive)

• - Removeddetect-libc@1.0.3(transitive)

• - Removedecc-jsbn@0.1.2(transitive)

• - Removedend-of-stream@1.4.4(transitive)

• - Removedexpand-template@1.1.1(transitive)

• - Removedextend@3.0.2(transitive)

• - Removedextsprintf@1.3.0(transitive)

• - Removedfast-deep-equal@3.1.3(transitive)

• - Removedfast-json-stable-stringify@2.1.0(transitive)

• - Removedfile-uri-to-path@1.0.0(transitive)

• - Removedforever-agent@0.6.1(transitive)

• - Removedform-data@2.3.3(transitive)

• - Removedfs-constants@1.0.0(transitive)

• - Removedfs.realpath@1.0.0(transitive)

• - Removedfstream@1.0.12(transitive)

• - Removedgauge@2.7.4(transitive)

• - Removedgetpass@0.1.7(transitive)

• - Removedgithub-from-package@0.0.0(transitive)

• - Removedglob@7.2.3(transitive)

• - Removedgraceful-fs@4.2.11(transitive)

• - Removedhar-schema@2.0.0(transitive)

• - Removedhar-validator@5.1.5(transitive)

• - Removedhas-unicode@2.0.1(transitive)

• - Removedhttp-signature@1.2.0(transitive)

• - Removedinflight@1.0.6(transitive)

• - Removedinherits@2.0.4(transitive)

• - Removedini@1.3.8(transitive)

• - Removedis-fullwidth-code-point@1.0.0(transitive)

• - Removedis-typedarray@1.0.0(transitive)

• - Removedisarray@1.0.0(transitive)

• - Removedisexe@2.0.0(transitive)

• - Removedisstream@0.1.2(transitive)

• - Removedjsbn@0.1.1(transitive)

• - Removedjson-schema@0.4.0(transitive)

• - Removedjson-schema-traverse@0.4.1(transitive)

• - Removedjson-stringify-safe@5.0.1(transitive)

• - Removedjsprim@1.4.2(transitive)

• - Removedmime-db@1.52.0(transitive)

• - Removedmime-types@2.1.35(transitive)

• - Removedmimic-response@1.0.1(transitive)

• - Removedminimatch@3.1.2(transitive)

• - Removedminimist@1.2.8(transitive)

• - Removedmkdirp@0.5.6(transitive)

• - Removednode-abi@2.30.1(transitive)

• - Removednode-gyp@3.8.0(transitive)

• - Removednoop-logger@0.1.1(transitive)

• - Removednopt@3.0.6(transitive)

• - Removednpmlog@4.1.2(transitive)

• - Removednumber-is-nan@1.0.1(transitive)

• - Removedoauth-sign@0.9.0(transitive)

• - Removedobject-assign@4.1.1(transitive)

• - Removedonce@1.4.0(transitive)

• - Removedos-homedir@1.0.2(transitive)

• - Removedos-tmpdir@1.0.2(transitive)

• - Removedosenv@0.1.5(transitive)

• - Removedpath-is-absolute@1.0.1(transitive)

• - Removedperformance-now@2.1.0(transitive)

• - Removedprebuild-install@2.5.3(transitive)

• - Removedprocess-nextick-args@2.0.1(transitive)

• - Removedpsl@1.15.0(transitive)

• - Removedpump@1.0.32.0.1(transitive)

• - Removedpunycode@2.3.1(transitive)

• - Removedqs@6.5.3(transitive)

• - Removedrc@1.2.8(transitive)

• - Removedreadable-stream@2.3.8(transitive)

• - Removedrequest@2.88.2(transitive)

• - Removedrimraf@2.7.1(transitive)

• - Removedsafe-buffer@5.1.2(transitive)

• - Removedsafer-buffer@2.1.2(transitive)

• - Removedsemver@5.3.05.7.2(transitive)

• - Removedset-blocking@2.0.0(transitive)

• - Removedsignal-exit@3.0.7(transitive)

• - Removedsimple-concat@1.0.1(transitive)

• - Removedsimple-get@2.8.2(transitive)

• - Removedsshpk@1.18.0(transitive)

• - Removedstring-width@1.0.2(transitive)

• - Removedstring_decoder@1.1.1(transitive)

• - Removedstrip-ansi@3.0.1(transitive)

• - Removedstrip-json-comments@2.0.1(transitive)

• - Removedtar@2.2.2(transitive)

• - Removedtar-fs@1.16.4(transitive)

• - Removedtar-stream@1.6.2(transitive)

• - Removedto-buffer@1.1.1(transitive)

• - Removedtough-cookie@2.5.0(transitive)

• - Removedtunnel-agent@0.6.0(transitive)

• - Removedtweetnacl@0.14.5(transitive)

• - Removeduri-js@4.4.1(transitive)

• - Removedutil-deprecate@1.0.2(transitive)

• - Removeduuid@3.4.0(transitive)

• - Removedverror@1.10.0(transitive)

• - Removedwhich@1.3.1(transitive)

• - Removedwhich-pm-runs@1.1.0(transitive)

• - Removedwide-align@1.1.5(transitive)

• - Removedwrappy@1.0.2(transitive)

• - Removedxtend@4.0.2(transitive)